Slashdot Mirror
Researchers Create An Undetectable Rootkit That Targets Industrial Equipment (bleepingcomputer.com)
An anonymous reader quotes Bleeping Computer: "Two researchers presenting at the Black Hat Europe security conference in London revealed a method of infecting industrial equipment with an undetectable rootkit component that can wreak havoc and disrupt the normal operations of critical infrastructure all over the world. The attack targets PLCs (Programmable Logic Controllers), devices that sit between normal computers that run industrial monitoring software and the actual industrial equipment, such as motors, valves, sensors, breakers, alarms, and others."
Researchers say they packed their attack as a loadable kernel module [PDF], which makes it both undetectable and reboot persistent. The attack goes after PLC pin configurations, meaning the PLC won't be able to tell which are the actual input and output pins, allowing the attacker full-control to make up bogus sensor data, send fake commands, or block legitimate ones.
The researchers acknowledge that the attack is extremely complicated, but the article argues it would still be of interest to a state-sponsored actor.
Researchers say they packed their attack as a loadable kernel module [PDF], which makes it both undetectable and reboot persistent. The attack goes after PLC pin configurations, meaning the PLC won't be able to tell which are the actual input and output pins, allowing the attacker full-control to make up bogus sensor data, send fake commands, or block legitimate ones.
The researchers acknowledge that the attack is extremely complicated, but the article argues it would still be of interest to a state-sponsored actor.
a new disease with no symptoms from attentino whores!
At some point, anyone bent on malicious programming _wants_ to be detected -- when the payload does whatever malice intended. Before then, it wants to hide. Loadable kernel modules are a good way to hide, but not perfect. It might be detected by network activity (gotta love those lights) or power consumption (machine not sleeping). Both AFAIK still major detection mechanisms for all intrustions.
But LKM are a known security risk, and can be turned off in Linux. Easy with known hardware. At one time OpenBSD did not allow LKM.
Some of us are old enough to remember PLC that worked fine by themselves, not needing to be hooked to any other "computer". Maybe we need to start thinking about making things simpler again, where it makes sense, for reasons of security, robustness and even longer life of the equipment.
The difficulty of messing with industrial equipment is not how to mess with the software, but in how to get access to it in the first place. These days most newer machines don't actually have a physical PLC(unless you count safety plc that only handles the safety), instead they run a soft plc on a PC, generally side by side with windows using VT-x. Once you have access to such a machine messing with it is really not hard at all.
The article is garbage. The author has no clue.
It does take some work to get into the position of being able to load a "kernel module". Is this work (the hardest part) "undetectable" too?
> At some point, anyone bent on malicious programming _wants_ to be detected -- when the payload does whatever malice intended.
Not at all. Espionage is a clear example. Surely the target will notice when their ship gets blown up, but you don't want them to know it was due to espionage, much less computer, and certainly you don't want them to know WHICH computers you have compromised.
With industrial control specifically, you may want to make the final device fail, perhaps have an ICBM explode at launch, but you don't want them to know that it failed because you've caused their CNC machine to cut a slot to have wider clearance than specified.
Isn't this just a re-worked version of the US / Israel joint effort to kill Iran's uranium enrichment program?
'Majid Hashemi : Avanade, a Microsoft / Accenture joint venture'
From billg:
To: mhashemi:
Cc: a.abbasi:
Msg: "Please write a report on Linux PLC malware so as to distract from the curent Microsoft Windows phishing/malware/virus infestation on the Internet."
Is there any other kind of rootkit except the undetectable kind. It's interesting that in that entire document they managed to mention Raspberry Pi 13 times, Linux 5 times and Microsoft Windows not at all.
This reminds of the old engineering saying "good, fast, cheap - pick any two". Only in this case it's "complex, configurable, secure - pick any two". If you want security then you either forego complexity, (so the device can't do a lot, plus all the combinations and permutations of its behaviour can be understood and determined in advance, plus its attack surface is correspondingly smaller), or you forego configurability, (meaning functionality is set in wires or DIP switches or ROM, not by software that can be altered).
Such complex and versatile systems, (such as the Internet), simply can't be protected adequately, unless they're disconnected from the outside world and therefore lose most of their advantages. What comprises solid protection today, probably won't tomorrow. We need to find ways of mitigating damage and recovering quickly; we can't rely on thwarting malicious hacking, because that's simply not possible in the long term. This applies equally to crappy consumer grade IoT gear and hardened SCADA systems. Yes, a good SCADA system is, (or should be), harder to compromise; but usually the payoff is commensurately bigger.
'The Economy' is a giant Ponzi scheme whose most pitiable suckers are the youngest among us and the yet-unborn.
How does the "persistent over reboots" part work? I haven't read the whole paper, but a search for "reboot" or related terms returns nothing.
My first program:
Hell Segmentation fault
You're sold up the river, and the media ignores the corruption.
Nixon - delete 18 min of audio, forced to resign, become Democrat's villain
Hillary - delete 300,000 emails documenting corruption and having illegal classified data, rides to nomination, becomes Democrat's hero.
They've found a cheap PLC they can exploit. Buy a decent PLC and you have a fair shot against something like this.
I was a PLC monkey (still am) when Stuxnet was new. Shortly afterward I watched one of my Clients, an automation manufacturer with a fairly decent market share migrate their critical products to signed firmware. Controllers, ethernet bridges, and industrial switches to start with, but it continues--there's signed firmware options for more and more of the available products.
You buy the products from an authorized reseller with unsigned firmware (if it's available) and if you want signed, you can flash it yourself.
After that, there's no going back--from that point forward you can only flash signed firmware from the mfr.
You can still put bad things in the user code, but such is the nature of user programs. Those can be signed, fingerprinted, and locked too.
Of course none of that is "proof against" attackers, but a real PLC should certainly not be as vulnerable as an embedded controller from a terminal block manufacturer.
These Wago units run about 500 bucks. You can get cheaper units with built-in I/O from new places like plcdirect, or used from radwell.
Heck, if you've got some patience you can get a "PLC" from aliexpress for less than fifty bucks. Won't have Ethernet, though.
If I delivered a project to a Client built around any of that stuff, they would *not* pay me; they'd sue me.
It's going to cost you around $2K (depending on your multiplier, of course...) to get a modern micro PLC with included I/O from a real automation company--trust ain't cheap.
"Reality is that which, when you stop believing in it, doesn't go away." - Philip K. Dick
Adding security could be done of course, and perhaps there are things to be done that should be. But for the majority of deployments total security adds complexity to protect against a threat which is extremely unlikely to ever happen. If you want to protect your PLCs from being tampered with, there is a far simpler solution - buy a big secure cabinet and a big padlock. If you're super paranoid, fill any firmware update slots with epoxy.
As the article mentions, this would likely need a nation state sponsor.
This attack is unfocused. The attacker probably has no idea what the individual IO points mean or do.
The attack would be only to destroy.
That's an Act of War.
You're next move Dr. Strangelove?
I write industrial control software. Most of my customers don't have their process control computers accessible, except as needed. As for IO points, at least with what I work on, each system is unique.
I program PLC's and SCADA systems and industrial touch screens, set up instrumentation and fully design and build systems, and have a few VFD certified factory startup certifications and this is silly (I'm also have Linux / IT background / network security past as well). basically any system doing something even remotely important is put on its own network island, many times only trusted employees have access to any sort of programming software (if there's any at all on site). so yes they are not in an of them selves secure devices like web server or some other server that's publicly available on the internet protocols like MODBUS or ENIP or CIP weren't designed with security in mind but versatility (and no encryption some passwords from time to time to keep honest people honest but guys like me know the factory builtin work arounds to any sort of password in the ICS world). traditionally PLC's all used proprietary protocols like DeviceNet, ProfiBUS, ModbusPlus but now that everything is going Ethernet enabled IT people keep thinking hey this is now something that exists in my realm and i need to regulate it but that is completely wrong and its nothing like business computer networking at all! all it has in common is the media looks the same and there are usually IP addresses. unless you built a system with PLC's who's people paychecks or drinking water relies on it working as an IT guy you should not touch it! (and most dont thank you) don't install a bunch of updates on SCADA PC's! (also don't connect it to the internet! unless there is no other choice and not for long these should only be used for the purpose of controlling the machine only don't let those operators web-surf or have solitare!) and don't be worried about PLC network security because there really is none if you can ping a PLC then you can completely reporgram it you just need that manufacturers software there are no passwords to go "online" with it generally and you can upload the current running program and even see what its doing. as long as it is in a completely isolated environment then that's idea and no WIFI! on process networks. its often a good idea to disconnect USB ports that connect to the front of the PC even.
this stuff has to work day in day out 24 hours a day reliability and predictably every time and with protocols IT people have no idea about so IP yes TCP maby UDP probably not and there are may other protocols that exist under the IP layer that are neither TCP or UDP which I've see IT people get hung up on time and time again thinking that there's nothing else out there and so they think its a great idea to put a firewall between my procecess equipment and Allen Bradley has an ethernet IP deployment guide that also explains the right way to deploy a large system and I have read it and fully agree with it and the all knowing IT people just throw that book out and tell me no thats not what were going to do because were security conscious and then some idiot in the middle of the night is tasked with upgrading the firmware on all the switches remotely at site X as usual and then shuts down the whole plant remotely which I've heard of horror stories where people almost died when a valve flew open which should not have (granted there was also some poor design fail close vs fail open stuff going on as well). but basically you cant treat this like you do an operating system vulnerability because because it would be completely irresponsible to have a PLC be publicly accessible to the internet it should require physical access to interfere with and physical access should be limited to those who need it. so security is a good thing but if the attack is this outlandish its not an issue and if you go too far with security be warned IT guy you may get fired for taking down a facility when you were doing what you normally do with business equipment which can go down briefly here and there process equipment generally can't go down EVER. as mr scott would say the more complicated the plumbing the easier it is to plug up the drain which is quit
Of course this is detectable. If it is loaded into the PLC persistently, then you can find it via a JTAG read and compare. If not, you can detect it during load.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.